Often times I am relied upon to examine email in the workplace in connection with violations of company policy. While most employees are prohibited from using company email for personal use, email forensics may reveal more than just loss of worker productivity.
Email forensics frequently uncovers information detailing inappropriate disclosures of trade secrets to clients and competitors, theft of intellectual property, and in some instances, the use of company resources by employees managing a competing business on the side.
Other concerns include interpersonal problems, such as harassing or threatening messages which may endanger an employee or prompt a law suit. All of these pose significant liabilities to the health and competitiveness of the company. An effective email forensic process may be employed to counteract these various problems and mitigate any potential damage.
It is important to keep in mind that email is a powerful tool that has all but revolutionized business communications. It is also very effective at recording the details of the messages exchanged, even in cases where the message has been deleted. In such cases, recorded data can be scattered across a computer’s hard drive. Email forensics is the process of reconstructing the bits of data to reveal the contents of the message. This process can also provide dates and times when the message was sent, IP address of the sender, and any files that may have been attached. A proper forensic analysis can be used to develop a narrative for the computer user’s activity.
Traditionally, email forensics will be relied upon to prove a case once a breach has been discovered. For example, a company looses a software contract with a client prior to resignation of a manger. It is discovered that the manager has subsequently gone to work for the client, and his employer becomes suspicious. A computer forensics analysis of the manager’s work computer reveals that the he had revealed proprietary information to the client during negotiations allowing them to outsource development of the program to a third vendor at a discount. Though the damage has been done, email forensics would be the vehicle for discovery of evidence to submit to the court in a claim for damages.
More significantly, an email forensic examination should be employed at the first sign of a potential problem in order to gain information as early as possible to prevent further damage from occurring. In a recent case it was suspected that an employee was sending/receiving inappropriate messages at work. Forensic examination of the computer yielded sexually explicit emails and attached images. Further analysis revealed that these messages were being exchanged with other co-workers. The organization in this case was able to react before the risk of sexual harassment was actually realized in the work place.
Many companies establish polices as a code of employee conduct. These policies announce expectations of appropriate work-time behavior and email usage. Minor breaches can have a relatively benign impact. However, computer forensics provides a valuable resource in assessing the situation, and a properly conducted analysis could help to mitigate potential damages, and prove invaluable in cases involving more egregious violations.
